It’s easy to be glib in answering a question like this and saying the best indicator would be no incidents, or no breaches, or no anything. However, as we all know, absence of evidence is not evidence ...